{"action":"opened","issue":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/6544","repository_url":"https://api.github.com/repos/openshift/openshift-ansible","labels_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/6544/labels{/name}","comments_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/6544/comments","events_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/6544/events","html_url":"https://github.com/openshift/openshift-ansible/issues/6544","id":283860653,"number":6544,"title":"Installation fails when ansible_become=yes is in all group","user":{"login":"sector2000","id":22235337,"avatar_url":"https://avatars1.githubusercontent.com/u/22235337?v=4","gravatar_id":"","url":"https://api.github.com/users/sector2000","html_url":"https://github.com/sector2000","followers_url":"https://api.github.com/users/sector2000/followers","following_url":"https://api.github.com/users/sector2000/following{/other_user}","gists_url":"https://api.github.com/users/sector2000/gists{/gist_id}","starred_url":"https://api.github.com/users/sector2000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sector2000/subscriptions","organizations_url":"https://api.github.com/users/sector2000/orgs","repos_url":"https://api.github.com/users/sector2000/repos","events_url":"https://api.github.com/users/sector2000/events{/privacy}","received_events_url":"https://api.github.com/users/sector2000/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-12-21T12:00:22Z","updated_at":"2017-12-21T12:00:22Z","closed_at":null,"author_association":"NONE","body":"#### Description\r\n\r\nThe inventory defines hosts for Openshift (OSEv3 group) but also non-Openshift hosts. For this reason some common variables are defined in the [all:vars] group.\r\nIn [all:vars] group are defined the following variables:\r\n\r\nansible_user=ansible\r\nansible_become=yes\r\nansible_become_user=root\r\n\r\nThe Openshift installation fails with:\r\n\r\nFailed to fetch the file: [Errno 13] Permission denied\r\n\r\nduring execution of etcd_server_certificates role.\r\n\r\nIf the variable ansible_become=yes is moved from [all:vars] group to [OSEv3:vars] group the installation succeeds. If the variable is defined in both groups the installation also fails.\r\n\r\n##### Version\r\n\r\nPlease put the following version information in the code block\r\nindicated below.\r\n\r\n\r\n```\r\n$ ansible --version\r\n\r\nansible 2.4.1.0\r\n\r\n  config file = /home/ansible/git-repos/openpaas-onprem_ext/ocp-installation/ansible.cfg\r\n\r\n  configured module search path = [u'/home/ansible/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']\r\n\r\n  ansible python module location = /usr/lib/python2.7/site-packages/ansible\r\n\r\n  executable location = /usr/bin/ansible\r\n\r\n  python version = 2.7.5 (default, May  3 2017, 07:55:04) [GCC 4.8.5 20150623 (Red Hat 4.8.5-14)]\r\n\r\n\r\n$ rpm -q atomic-openshift-utils openshift-ansible\r\n\r\natomic-openshift-utils-3.6.173.0.48-1.git.0.1609d30.el7.noarch\r\n\r\nopenshift-ansible-3.6.173.0.48-1.git.0.1609d30.el7.noarch\r\n```\r\n\r\n##### Steps To Reproduce\r\n1. Create inventory file defining ansible_user and ansible_become_user in [OSEv3:vars] group\r\n2. Put only ansible_become=yes in [all:vars] group\r\n3. Run Openshift installation with ansible-playbook /usr/share/ansible/openshift-ansible/playbooks/byo/config.yml\r\n\r\n\r\n##### Expected Results\r\nInstallation should complete successfully\r\n\r\n\r\n##### Observed Results\r\nInstallation fails with:\r\n\r\nFailed to fetch the file: [Errno 13] Permission denied\r\n\r\nduring execution of etcd_server_certificates role.\r\n\r\n```\r\n....... |  TASK [etcd_server_certificates : Retrieve etcd cert tarball] ****************************************************************************************************************************************\r\n2017-11-24 12:26:20,771 p=1863 u=***************** |  fatal: [*****************]: FAILED! => {\r\n    \"failed\": true\r\n}\r\n\r\nMSG:\r\n\r\nFailed to fetch the file: [Errno 13] Permission denied: '/tmp/etcd_certificates-c3UDgOu/etcd-*****************.tgz'\r\n\r\n2017-11-24 12:26:20,780 p=1863 u=***************** |  fatal: [*****************]: FAILED! => {\r\n    \"failed\": true\r\n}\r\n\r\nMSG:\r\n\r\nFailed to fetch the file: [Errno 13] Permission denied: '/tmp/etcd_certificates-dXSJuHq/etcd-*****************.tgz'\r\n\r\n2017-11-24 12:26:20,787 p=1863 u=***************** |  fatal: [*****************]: FAILED! => {\r\n    \"failed\": true\r\n}\r\n\r\nMSG:\r\n\r\nFailed to fetch the file: [Errno 13] Permission denied: '/tmp/etcd_certificates-nqRs9AD/etcd-*****************.tgz'\r\n```\r\n\r\n\r\n##### Additional Information\r\n\r\nOS: RHEL 7.4\r\n\r\nThe same error impacts also other roles. The ones that I found are at least:\r\n- etcd_server_certificates\r\n- etcd_client_certificates\r\n- openshift_master_certificates\r\n- openshift_node_certificates\r\n- openshift_logging\r\n\r\nbut there are most probably more. It seems to occur whenever the role includes a task with\r\n\r\n```\r\nlocal_action: command mktemp ......\r\nbecome: no\r\n```\r\n"}}
{"actor":{"display_login":"sector2000"}}